Hacker Returns 90% of Stolen Renegade Dark Pool Funds After Bounty Offer

Renegade Dark Pool secures the return of 90% of its stolen assets Monday after a whitehat attacker accepts an on-chain settlement to resolve a $209,000 exploit. The resolution provides a rare instance of high-speed recovery in the decentralized finance sector, with the hacker transferring the funds back to the protocol less than an hour after a formal bounty offer appeared on the blockchain.

The exploit originated on May 10, 2026, targeting Renegade’s first-generation deployment on the Arbitrum network. Security analysts at Blockaid first detected the anomaly at 8:27 a.m. UTC Sunday, identifying a drain of roughly $209,000 spread across 27 different ERC-20 tokens. The attacker bypassed standard protocol safeguards by injecting malicious logic into the resolver infrastructure.

Renegade officials confirmed the breach remained isolated to the V1 Arbitrum instance. Other protocol deployments, including those on the Base network and the more recent V2 iterations, maintained full security. Engineers responded by pausing the infrastructure supporting trades against the compromised Arbitrum V1 deployment to prevent further contagion.

The protocol team initiated negotiations via a public on-chain message on May 11. The team offered the hacker a 10% whitehat bounty, worth approximately $20,000, in exchange for the return of the remaining 90%. The settlement included a promise from Renegade to refrain from pursuing civil or criminal litigation. The attacker accepted the terms and returned roughly $190,000 in assets within 45 minutes of the message being indexed.

The hacker later posted an on-chain note claiming the initial drain served as a demonstration of a critical vulnerability. The exploiter argued the action protected DeFi users by forcing a fix for a flaw that others might have used maliciously. Renegade described the outcome as a positive resolution that avoided the lengthy delays and costs associated with traditional law enforcement recovery efforts.

Renegade operates as a privacy-focused decentralized exchange, utilizing zero-knowledge proofs to allow institutional-grade trading without exposing order details to the public mempool. The dark pool model seeks to eliminate front-running and price impact for large-scale trades. While the exploit targeted older code, the swift recovery underscored the efficacy of the “bounty-for-immunity” social contract currently prevalent in Ethereum-based ecosystems.

Affected users will receive full compensation from the recovered funds. The protocol team emphasized that the Arbitrum V1 deployment will stay offline until a comprehensive security audit of the resolver infrastructure is completed.

Chain Street’s Take

Renegade’s recovery highlights the emergence of a “DeFi common law” where on-chain bounties act as a more efficient deterrent than legacy legal systems. A 90% recovery rate in under 48 hours is a result rarely seen in centralized finance. The event exposes a specific risk for dark pools: the very infrastructure designed for privacy can become a playground for sophisticated logic injections if the resolver layer isn’t airtight.

Users avoided a total loss because the attacker prioritized a clean payout over the risks of laundering stolen ERC-20 tokens. The 10% bounty is effectively a “security tax” paid by the protocol for a live-fire audit. As dark pools gain traction among institutional traders, the industry should expect more formal, pre-emptive bug bounty programs to replace these reactive, high-stakes negotiations. Trust in a dark pool relies on the invisibility of the trade, but here, a very public recovery was required to save the protocol’s reputation.